CVE-2026-101009
Received Received - Intake

Command Injection in aaPanel BaoTa Unzip Handler

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101009
EUVD
EUVD-2026-88106

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
aapanel baota to 11.8.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101009 is a command injection vulnerability in aaPanel BaoTa up to version 11.8.0. It exists in the Unzip Handler component, specifically in the panelTask.bt_task._unzip function of the file /www/server/panel/class/panelTask.py. The vulnerability allows attackers to inject malicious shell commands via the Password argument during ZIP file extraction. This can lead to remote code execution as the root user.

Detection Guidance

Check for unusual activity in web server logs, particularly POST requests to /files?action=UnZip with suspicious password parameters. Look for files like /tmp/bt_pwned_h05 created by attackers. Monitor for unexpected root-level command execution or file modifications.

Impact Analysis

This vulnerability enables full system compromise. Attackers can execute arbitrary commands with root privileges, leading to complete host takeover. They can create persistence mechanisms, add backdoor accounts, perform lateral movement within networks, and exfiltrate sensitive data. The attack is performed remotely and requires no authentication beyond network access to the vulnerable panel.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized root access and potential data exfiltration. GDPR requires protection of personal data and breach notification, while HIPAA mandates safeguards for protected health information. A successful exploit would constitute a data breach, triggering mandatory reporting and potential fines under both regulations.

Mitigation Strategies

Immediately update aaPanel BaoTa to the latest version if available. If no patch exists, disable the UnZip functionality in the web panel or restrict access to the /files?action=UnZip endpoint. Implement strict input validation for the password parameter and monitor for exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart